feat: complete governed L1-L3 supply chain workflow

[falltwo]

Summary

• complete the L1 Risk Observer, L2 Intelligence & Decision, and L3 Approval & Execution product tiers
• add durable purchase proposals with server-side evidence revalidation, separation of duties, atomic execution, effect uniqueness, and idempotent receipts
• preserve source-line identity across demo reseeding and fail fast on legacy non-demo databases without an organization boundary
• refresh the public documentation with Traditional Chinese and English READMEs plus English v1.0 release notes and a factual v0.1 comparison

Verification

• 327 passed
• Python compile verification passed
• git diff --check passed
• Markdown local links and code fences validated
• commit-level boundary and high-confidence secret scan passed for all 25 changed files
• independent read-only code review: Ready to merge — Yes

Security and scope

• one SQLite database represents one organization in this PoC
• atomic approval, replay, and traceability claims apply to the protected AI/Gateway procurement workflow
• private assistant metadata, planning files, databases, environment files, logs, credentials, local paths, and private archive identifiers are excluded

Release plan

After CI succeeds, the final commit will be rescanned and sent through the second release Gate before merge and the public v1.0 release.